Loading...
Loading...
Borys Ulanenko
CEO of ArmsLength AI
Get the latest transfer pricing insights, AI benchmarking tips, and industry updates delivered straight to your inbox.
CbCR risk assessment is how tax authorities use Country-by-Country Reporting data to score transfer pricing and BEPS risk, select cases, and plan targeted enquiries—ahead of any transaction-level review. In practice, authorities compute ratio outliers (e.g., profit per employee, profit per tangible assets, effective tax rate) and then corroborate signals using the Master File, Local Files, tax returns, and other datasets. Under OECD “appropriate use,” CbCR should not be used to make formulary adjustments or as conclusive evidence of arm’s length outcomes (OECD Action 13 (2015) ¶25, ¶59). The most effective taxpayer response is a repeatable pre-filing self-assessment plus a disciplined Table 3 narrative that explains predictable anomalies and data-source choices.
Terminology note (ETR): in CbCR analytics, “ETR” is commonly computed using Income Tax Accrued – Current Year divided by Profit (Loss) before Income Tax (a current-tax proxy). This is different from “ETR” in Pillar Two transitional safe harbour calculations, which uses Simplified Covered Taxes derived from Qualified Financial Statements (OECD (2022) Safe Harbours and Penalty Relief).
Tax authorities receive CbC reports to get a jurisdiction-by-jurisdiction picture of where a group reports revenue, profit, tax, and proxies for real activity (employees and tangible assets). That makes CbCR unusually “algorithm-friendly”: it’s standardized, repeatable year-over-year, and comparable across large populations.
Scope and thresholds vary by regime. The OECD standard uses a consolidated revenue threshold of €750 million (or a near equivalent in domestic currency) based on the immediately preceding fiscal year (OECD Action 13 (2015)). In the EU, DAC4 applies to MNE groups with consolidated revenue ≥ €750 million and an EU presence (European Commission — DAC4). In the US, CbCR is filed on Form 8975 using a $850 million preceding-period revenue threshold (IRS Form 8975 / Treas. Reg. §1.6038-4).
The OECD standard is explicit: CbCR supports high-level transfer pricing risk assessment, other BEPS-related risk assessment, and (where appropriate) economic/statistical analysis—but it is not a substitute for a detailed TP analysis and should not be used to make income adjustments via a formula (OECD Action 13 (2015) ¶25, ¶59).
For taxpayers, “appropriate use” matters even when your local audit team is careful: CbCR is exchanged across jurisdictions. A single unexplained anomaly can trigger multi-country questions, coordinated issue selection, or a “please reconcile” request chain.
Even though authorities shouldn’t assess arm’s length pricing directly from CbCR, they can (and do):
If you want to manage cbcr risk assessment outcomes, start with what the dataset actually contains.
Table 1 aggregates, by tax jurisdiction: total revenue (split related/unrelated), profit (loss) before income tax, income tax paid (cash), income tax accrued (current year), stated capital, accumulated earnings (often referred to internally as “retained earnings”), number of employees, and tangible assets other than cash (OECD Action 13 (2015), CbCR template).
Table 2 lists the constituent entities in each jurisdiction and their main business activities. This is where authorities check whether the story “fits” (e.g., an IP holding entity vs. a full-function operating hub).
Table 3 (“Additional Information”) exists to provide brief information or explanation that is necessary—or that would facilitate understanding—of the compulsory information in Tables 1 and 2 (OECD Action 13 (2015), CbCR template; OECD (2017) CbCR Handbook). In a ratio-driven world, Table 3 is often the difference between a flagged outlier that is explainable and a flagged outlier that becomes an audit plan.
Treat Table 3 as a controlled “variance explanation” schedule: explain only what a reasonable analyst would need to avoid a wrong inference, and point to where the detailed support sits (Master File/Local File/workpapers).
The OECD’s handbook and tax administration practice (including the OECD “common errors” note) point to a fairly consistent process (OECD (2017) CbCR Handbook; OECD (May 2025) Common errors).
| Stage | What happens | Why it matters to you |
|---|---|---|
| 1) Ingestion & schema validation | XML/schema checks; technical rejects or flags | Technical failures can delay filing acceptance and trigger follow-up |
| 2) Data quality checks | Completeness, jurisdiction/entity consistency, currency logic, unusual placeholders | “Bad data” is itself a risk indicator and can undermine credibility |
| 3) Automated scoring | Ratio dashboards, trend flags, peer comparisons where available | Most issue selection is driven here |
| 4) Qualitative overlay | Review Table 2 activities + Table 3 explanations | Good Table 3 notes can de-escalate outliers |
| 5) Corroboration | Compare against TP files, returns, accounts, customs/VAT, WHT | Misalignment drives enquiries |
| 6) Case selection & audit planning | Pick jurisdictions/issues; draft questions; coordinate where needed | You’ll see targeted, ratio-led questionnaires |
A common taxpayer mistake is assuming “nobody reads CbCR.” In reality, CbCR is often machine-scored first and read only when the score (or a specific ratio) crosses an internal threshold.
Tax authorities generally compute indicators directly from Table 1. The OECD handbook describes these as risk indicators, not conclusions (OECD (2017) CbCR Handbook).
Use the same basic formulas a tax authority will use:
“Two ETRs” that often get mixed up
| Indicator | Typical “why it flags risk” | Common legitimate explanations (should be in Table 3 or TP files) |
|---|---|---|
| Profit per employee | High profit with low headcount suggests profit concentration vs. substance | Automation, high-value intangibles with real DEMPE, central entrepreneur with controlled outsourcing |
| Profit per tangible assets | High return on tangibles suggests intangible-driven profit in low-tax locations | IP ownership + DEMPE, contract manufacturing vs. principal model, measurement differences for tangible assets |
| Low ETR (CbCR current-tax proxy) | Potential low-tax profit parking, incentives, mismatched tax bases | Tax holidays/patent box, loss utilization, tax credits, exempt income under local law, statutory rate differences, one-off current-year items that affect taxable profit vs accounting PBT (document what it is and why it recurs/doesn’t) |
| Tax paid materially below tax accrued (over time) | Potential cash-tax leakage, disputes, or timing patterns that merit follow-up | Loss carryforwards affecting cash tax, withholding tax mechanics, refunds/offsets, settled/unsettled disputes, payment timing differences (OECD (2017) CbCR Handbook) |
| High related-party revenue share | Signals hub entities, principal models, financing centers | Centralized procurement, centralized IP licensing, genuine service center with cost-plus |
| Persistent losses in market jurisdictions | Mismatch with “routine distributor/manufacturer” characterization | Start-up/exit, market disruption, one-off write-downs, deliberate market investment supported by comparables |
| Sudden year-over-year shifts | Profit movement without people/assets movement suggests restructuring or pricing change | Post-merger integration, transfer of intangibles, supply chain changes, exceptional items |
Authorities tend to combine indicators. A low ETR alone may not be enough. A low ETR plus:
is a classic “stacked” risk case in the OECD examples (OECD (2017) CbCR Handbook).
CbCR audit triggers are rarely a single number. They’re patterns that look inconsistent with a value chain story.
The risk event is often not the structure—it’s the gap between (1) where CbCR shows profit, (2) where the Master File says value is created, and (3) how Local Files support the tested party outcomes.
A practical cbcr risk assessment process should be repeatable, evidence-based, and timed before filing—so you can correct errors, adjust Table 3 explanations, and ensure documentation alignment.
The OECD’s 2025 note emphasizes that many administrations run automated validations and may request corrections (OECD (May 2025) Common errors). Build these checks into your close process:
Action 13’s template instructions also expect you to describe data sources and state the exchange rate approach in Table 3 / “Additional Information” (OECD Action 13 (2015), template instructions).
At minimum, compute:
Then segment jurisdictions into:
For each explainable outlier, draft:
This becomes your Table 3 content and your internal “audit-ready” memo.
Table 3 is not a dumping ground. It is a short, structured explanation designed to prevent misinterpretation (OECD (2017) CbCR Handbook; OECD Action 13 (2015), CbCR template).
Include short bullets under clear headings:
Data sources & methodology
Material one-offs by jurisdiction
ETR drivers (for the CbCR current-tax proxy)
Business model explanations
If Table 3 contains a “new story” that is not reflected in your Master File/Local Files, you may convert a ratio anomaly into a credibility problem.
CbCR is aggregated; Master File and Local Files are narrative + transactional. Authorities use CbCR to decide where to look, then use TP documentation to decide what to challenge.
Pillar Two transitional safe harbours are explicitly designed to reduce compliance burden by allowing groups to use Qualified CbC Reports and Qualified Financial Statements as the basis for a safe-harbour conclusion (OECD (2022) Safe Harbours and Penalty Relief). Even if your Pillar Two computation is “separate,” the operational reality is: the same teams and systems often feed both.
Transitional CbCR Safe Harbour (what matters operationally in 2025)
Pillar Two guidance and administration are evolving. Operationally, treat your CbCR governance as “shared infrastructure” for Pillar Two: data lineage, FX methodology, sign-offs, and a controlled variance narrative.
Facts (Table 1 extract):
| Jurisdiction | Unrelated rev | Related rev | Total rev | PBT | Tax accrued | Employees | Tangible assets |
|---|---|---|---|---|---|---|---|
| Country H (holding/IP) | 5 | 995 | 1,000 | 600 | 6 | 10 | 20 |
| Country M (market) | 1,500 | 50 | 1,550 | 40 | 10 | 1,000 | 300 |
What the authority computes (and why it spikes risk):
This combination (very high profit/substance ratios + very low ETR + heavy related-party revenue) is a textbook hypothesis generator under the OECD handbook approach (OECD (2017) CbCR Handbook).
Pre-filing response (what to do before you file):
Table 3 response (what to say, briefly):
Facts (two-year trend):
| Jurisdiction | Total rev (2024) | PBT (2024) | Tax accrued (2024) | Employees | Total rev (2025) | PBT (2025) |
|---|---|---|---|---|---|---|
| Country D (distribution) | 900 | -25 | 0 | 250 | 1,050 | -30 |
Key signal:
If the Master File describes Country D as a limited-risk/routine distributor, persistent losses create a natural audit question: why is a routine distributor bearing sustained losses? (OECD (2017) CbCR Handbook).
Pre-filing decision: explainable vs. pricing issue
Table 3 response (example):
| Risk area | Control | Owner |
|---|---|---|
| Entity completeness (Table 2) | Legal entity inventory reconciliation; PE review | Tax + Legal |
| FX/currency consistency | Documented FX methodology; automated variance checks | Consolidation + Tax |
| Ratio outliers | Jurisdiction dashboard + explanation memo | TP team |
| Documentation alignment | Annual “CbCR ↔ Master ↔ Local” consistency review | TP lead |
| Filing readiness | Pre-submission XML/schema validation and peer review | Compliance |
CbCR risk assessment is a high-level screening process where tax authorities use CbC report data to identify transfer pricing and BEPS risk indicators and prioritize cases for enquiry or audit (OECD Action 13 (2015) ¶25).
Under OECD “appropriate use,” they should not use CbCR as conclusive evidence or apply formulary allocation adjustments based on CbCR data (OECD Action 13 (2015) ¶59).
Common indicators include profit per employee, profit per tangible assets, low ETR (as a current-tax proxy), high related-party revenue share, persistent losses in market jurisdictions, unexplained year-over-year shifts, and mismatches between income tax paid and income tax accrued patterns (OECD (2017) CbCR Handbook).
Many administrations perform automated schema and logic checks at filing and additional validations before/after exchange; material errors can lead to correction requests (OECD (May 2025) Common errors).
Use Table 3 to provide brief, specific explanations needed to understand Tables 1–2—especially for predictable outliers (low current-tax ETR, one-offs, restructurings) and to describe key methodology choices such as data sources and FX approach (OECD Action 13 (2015), CbCR template; OECD (2017) CbCR Handbook).
Triggers usually involve combinations of outliers (profit/substance, low ETR), mobile activities inferred from Table 2, persistent losses in large markets, sudden profit shifts without people/assets movement, data inconsistencies, or misalignment with Master/Local Files (OECD (2017) CbCR Handbook; OECD (May 2025) Common errors).
Alignment helps reconcile “where profits are reported” (CbCR) with “where value is created” (Master File) and “how transactions are priced” (Local Files), reducing the chance that CbCR outliers become audit hypotheses (OECD Action 13 (2015) ¶25).
Yes—especially operationally. The Pillar Two Transitional CbCR Safe Harbour relies on a Qualified CbC Report (for PBT) and Qualified Financial Statements (for Simplified Covered Taxes), runs through fiscal years beginning on/before 31 Dec 2026, and includes transition rates of 15%/16%/17% (OECD (2022) Safe Harbours and Penalty Relief). This increases sensitivity to CbCR data quality, governance, and consistent variance explanations.
Under the OECD standard, CbCR generally applies to groups with annual consolidated group revenue of at least €750 million (or a near equivalent amount in domestic currency) in the immediately preceding fiscal year (OECD Action 13 (2015)). Local implementations can differ—for example, the US Form 8975 threshold is $850 million for the preceding reporting period (IRS Form 8975 / Treas. Reg. §1.6038-4). If you’re in scope, you should assume CbCR will be used for automated risk scoring and plan governance, dashboards, and Table 3 narratives accordingly.